Listen to this Post
The vulnerability occurs in mruby versions up to 3.4.0 within the sort_cmp function in src/array.c. This function handles element comparisons during array sorting operations. A use-after-free condition arises when the function accesses memory that has been previously freed. An attacker with local access can craft a specific array to manipulate sorting, causing sort_cmp to reference freed memory. This can lead to corruption of data structures, potential arbitrary code execution, or application crash. The exploit leverages improper memory management during comparison, where freed elements are still referenced. The public disclosure of the exploit increases the risk of malicious use. The patch, commit eb398971bfb43c38db3e04528b68ac9a7ce509bc, addresses this by ensuring valid memory access in sort_cmp. The CVSS 4.0 score of 4.8 (MEDIUM) reflects local attack vector, low privileges required, and limited impact on confidentiality, integrity, and availability. Systems running unpatched mruby are vulnerable to local attacks that could disrupt services or execute code.
Platform: mruby
Version: up to 3.4.0
Vulnerability: Use after free
Severity: Medium
date: 2025-11-13
Prediction: Patch released 2025-12-04
What Undercode Say:
Analytics:
Check mruby version mruby --version Clone repository for patching git clone https://github.com/mruby/mruby.git Apply the security patch git checkout eb398971bfb43c38db3e04528b68ac9a7ce509bc
How Exploit:
Craft malicious array to trigger use-after-free in sort_cmp, causing memory corruption or crash via local access.
Protection from this CVE:
Apply patch commit eb398971bfb43c38db3e04528b68ac9a7ce509bc or update mruby.
Impact:
Local code execution, denial of service, or privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
